~ / search / GHSA-2p57-rm9w-gvfp

GHSA-2p57-rm9w-gvfp

ip SSRF improper categorization in isPublic

Source: GitHub Advisory Database (reviewed) High CVE-2024-29415

Packages

EcosystemPackageAffectedFixed in
npm ip <= 2.0.1 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.

References

External links from the advisory. They lead to third-party sites.